John Cuthbert 
WordPress 7.1.2 shipped on 22 September 2026, and it’s not a routine maintenance release — it’s a security release, and a serious one.
What was fixed
The update patches a critical-severity vulnerability (CVE-2026-87902 / GHSA-7hp8-65ch-5whp) in how WordPress resolves page templates. Under certain conditions, an unauthenticated attacker could manipulate that resolution to load a chosen, readable local PHP file from outside the active theme’s directories — a path that can lead to remote code execution. In plain terms: on an affected, unpatched site, an attacker doesn’t need a login to potentially run their own code on your server.
WordPress credits Robert Ressl for responsibly disclosing the issue before it became public, which is exactly how this is supposed to work — the fix was ready and shipped before anyone had to worry about it being exploited in the wild.
Who needs to act
Anyone running an eligible WordPress installation. The WordPress security team backported the fix all the way through version 4.7 as a courtesy, but it’s worth remembering that only the current major version is actively supported going forward — if you’re on something that old, this is a good prompt to plan an upgrade, not just apply the patch.
What to do
- If your site auto-updates for minor/security releases (the WordPress default for most installs), you’re likely already patched — check your dashboard to confirm.
- If not, update immediately via the Updates screen or a fresh download from WordPress.org. WordPress’s own guidance here is blunt: “it is recommended that you update your sites immediately.”
Where Devsigh sites stand
Both our production and staging environments were already running 7.1.2 by the time we checked — patched before this post went out. If you’re one of our managed clients, this is already handled on our end. If you manage your own WordPress installation and aren’t sure whether you’re covered, that’s worth checking today, not next week.
